← 返回 Skills 市场
freakyflow

Garminskill

作者 freakyflow · GitHub ↗ · v1.3.1
cross-platform ✓ 安全检测通过
1682
总下载
3
收藏
3
当前安装
8
版本数
在 OpenClaw 中安装
/install garmin-pulse
功能描述
Syncs daily health and fitness data from Garmin Connect into markdown files. Provides sleep, activity, heart rate, stress, body battery, HRV, SpO2, and weight data.
使用说明 (SKILL.md)

Garmin Connect

This skill syncs your daily health data from Garmin Connect into readable markdown files.

Setup

Authentication is required before the first sync. This only needs to happen once — tokens are cached for approximately one year.

If the sync command fails with "No cached tokens found", tell the user to run the setup command in their terminal:

uv run {baseDir}/scripts/sync_garmin.py --setup --email [email protected]

The password is prompted interactively via getpass — it is never echoed to screen, stored in shell history, or passed as a command argument. On success the user will see Success! Tokens cached in ~/.garminconnect. After that, all syncs use cached tokens only — no credentials are needed.

Do not ask the user for their password in chat and do not pass passwords as command-line arguments or via stdin piping, as these methods can expose credentials in process listings or conversation history.

Syncing Data

Sync today's data:

uv run {baseDir}/scripts/sync_garmin.py

Sync a specific date:

uv run {baseDir}/scripts/sync_garmin.py --date 2026-02-07

Sync the last N days:

uv run {baseDir}/scripts/sync_garmin.py --days 7

Reading Health Data

Health files are stored at {baseDir}/health/YYYY-MM-DD.md — one file per day.

To answer health or fitness questions, read the relevant date's file from the {baseDir}/health/ directory. If the file doesn't exist for the requested date, run the sync command for that date first.

Dependencies

This skill uses uv to run the sync script. uv is a fast Python package manager by Astral that reads inline script metadata (PEP 723) and automatically installs dependencies (garminconnect, cloudscraper) in an isolated environment — no manual pip install needed.

Credentials & Stored Data

Garmin Connect does not offer a public OAuth API, so a one-time email/password login is required. During setup, the password is used once to obtain OAuth tokens, then discarded. The tokens are cached locally in ~/.garminconnect/ for approximately one year. At runtime, only the cached tokens are used — no email or password is needed. If tokens expire, re-run the setup command.

Paths written by this skill:

  • ~/.garminconnect/ — cached OAuth tokens (sensitive; grants access to the user's Garmin account)
  • {baseDir}/health/ — daily health markdown files (contains personal health data)

Cron Setup

Schedule the sync script to run every morning using OpenClaw's cron tool so your health data stays up to date automatically. No environment variables or credentials are needed — the sync uses cached tokens from the one-time setup.

安全使用建议
What to consider before installing: - Account security: The script requires a one-time email/password login and caches OAuth tokens in ~/.garminconnect. Those tokens grant access to your Garmin account — protect the directory (file permissions) and avoid backing it up to untrusted cloud storage. - 2FA recommendation: The README says the garminconnect library does not support 2FA and instructs disabling two-step verification to use the skill. Disabling 2FA weakens your account security; weigh this tradeoff and consider using a separate Garmin account if you want to maintain MFA on your main account. - Dependency trust: The skill relies on the garminconnect and cloudscraper Python libraries. cloudscraper is explicitly used to bypass Cloudflare protections; while necessary to access the Garmin SSO endpoints, it increases the network/automation complexity. Review those libraries and the script if you have concerns about network behavior. - Installation source: The registry uses Homebrew to install uv (preferred). The README also documents curl | sh installers for uv — avoid running installers from unknown hosts unless you trust them. Prefer package manager installs from trusted repositories. - Local setup only: Setup is interactive and runs locally (uv run ...). Do not paste passwords into chat or allow remote agents to perform setup. The skill has disable-model-invocation enabled, which prevents the model from autonomously running it. - Audit if needed: If you want extra assurance, review the included script (scripts/sync_garmin.py) yourself or run it in a constrained environment. Consider creating a secondary Garmin account for testing if you don't want to alter your main account's security settings. Overall: the skill appears to do what it claims and is proportionate to its purpose, but be mindful of the explicit advice to disable 2FA and of the sensitive cached tokens it stores locally.
功能分析
Type: OpenClaw Skill Name: garmin-pulse Version: 1.3.1 The OpenClaw skill 'garmin-pulse' is designed to sync health data from Garmin Connect to local markdown files. The `SKILL.md` provides clear instructions for the AI agent, including secure password handling via `getpass` during setup and explicit guidance on where to store and retrieve data. The `scripts/sync_garmin.py` script uses legitimate libraries (`garminconnect`, `cloudscraper`) to interact with Garmin's API and writes all fetched data to local files within the skill's directory or the user's home directory (`~/.garminconnect/` for tokens). There is no evidence of data exfiltration to unauthorized external endpoints, malicious execution, persistence mechanisms, or prompt injection attempts designed to subvert the agent's intended behavior.
能力评估
Purpose & Capability
Name/description, required binary (uv), and the bundled Python script all match: the skill logs into Garmin Connect (via garminconnect + cloudscraper) and writes markdown files under the skill's directory. Requested binaries and dependencies are proportional to syncing Garmin data.
Instruction Scope
Runtime instructions are narrowly scoped to setup (interactive password prompt) and syncing data. They explicitly instruct the user to run a one-time setup in a terminal and warn not to paste passwords into chat. However, the README advises disabling Garmin two-factor authentication (2FA) because the underlying library doesn't support 2FA — this is a security tradeoff that users should consider. The script also uses cloudscraper to bypass Cloudflare, which is functionally necessary but worth knowing about.
Install Mechanism
Registry install metadata uses a Homebrew formula for uv (reasonable). The skill relies on uv to create an isolated environment and fetch Python deps (garminconnect, cloudscraper) per inline metadata. The README additionally documents curl | sh installers for uv (common but higher-risk), so users should prefer trusted package sources (Homebrew) and be aware uv will fetch packages from public PyPI at runtime.
Credentials
The skill requests no environment variables or external credentials in the registry metadata. It performs a one-time interactive login and caches OAuth tokens in ~/.garminconnect, which is expected for this purpose. Those cached tokens are sensitive (they grant access to the Garmin account) but their use is proportional to the stated function.
Persistence & Privilege
always is false and disable-model-invocation is true in the skill metadata, limiting autonomous invocation. The skill persists tokens to ~/.garminconnect and writes daily markdown files under the skill baseDir/health/ — these are expected artifacts for the feature. The skill does not request system-wide config changes or other skills' credentials.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install garmin-pulse
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /garmin-pulse 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.3.1
Address security scan: add disable-model-invocation to prevent autonomous agent syncs. Document stored paths (token cache, health data). Update metadata namespace.
v1.3.0
Add --verbose flag for debugging silent fetch failures. Fix SKILL.md slug to match ClawdHub. Fix README upgrade instructions for PEP 723 inline deps.
v1.2.1
Add retry with exponential backoff for transient 'No profile' auth failures. Retries up to 3 times before showing error.
v1.2.0
Improved error messages for common auth failures (No profile, 2FA, Cloudflare). Added troubleshooting section to README. Cross-platform uv install instructions.
v1.1.1
Remove printf pipe example from setup instructions (leaks password via process listings). Remove remote shell script installer from metadata (keep Homebrew only). Explicitly instruct agent not to handle passwords in chat or CLI args.
v1.1.0
Two-phase auth: separate setup (one-time, interactive) from sync (tokens only). Removes GARMIN_EMAIL/GARMIN_PASSWORD from requires.env — agent never needs credentials at runtime. Adds uv install spec to metadata. Resolves ClawHub security scan warnings for Install Mechanism, Credentials, and Instruction Scope.
v1.0.1
Fix metadata format for ClawHub registry, add homepage and credentials section
v1.0.0
- Initial release. - Syncs daily health and fitness data from Garmin Connect into markdown files. - Captures sleep, activity, heart rate, stress, body battery, HRV, SpO2, and weight data. - Offers commands to sync today's data, a specific date, or a range of days. - Stores data in easily accessible markdown files, one per day. - Includes guidance for automated daily syncing with cron.
元数据
Slug garmin-pulse
版本 1.3.1
许可证
累计安装 3
当前安装数 3
历史版本数 8
常见问题

Garminskill 是什么?

Syncs daily health and fitness data from Garmin Connect into markdown files. Provides sleep, activity, heart rate, stress, body battery, HRV, SpO2, and weight data. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 1682 次。

如何安装 Garminskill?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install garmin-pulse」即可一键安装,无需额外配置。

Garminskill 是免费的吗?

是的,Garminskill 完全免费(开源免费),可自由下载、安装和使用。

Garminskill 支持哪些平台?

Garminskill 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Garminskill?

由 freakyflow(@freakyflow)开发并维护,当前版本 v1.3.1。

💬 留言讨论